Examkin

Question

Difficulty: Very hardIdentity and Access Management Operations

An enterprise infrastructure security team is performing a post-incident audit across a hybrid multi-cloud environment. Log correlation reveals that a former cloud administrator whose Active Directory account was disabled during an automated offboarding process was still able to access confidential production storage buckets two days later:

[2026-07-25 09:00:00] AD_EVENT: User 'dev_admin_04' status updated to DISABLED via HR workflow.
[2026-07-25 09:01:15] SCIM_EVENT: Provisioning sync sent DELETE request for user GUID 'usr-99482' to Cloud IdP -> HTTP 200 OK.
[2026-07-27 14:10:22] API_GATEWAY: OAuth Token Refresh Request for Client ID 'App-Storage-v2' using Refresh Token 'rt_88dfa2...'.
[2026-07-27 14:10:23] CLOUD_IDP: Token Endpoint issued new Access Token 'at_44c12...' without re-evaluating directory account state.
[2026-07-27 14:11:05] STORAGE_SERVICE: GET /buckets/prod-finance-db -> HTTP 200 OK (Authenticated via 'at_44c12...').

Which of the following operational root causes BEST explains why the offboarded administrator retained API access despite successful SCIM deprovisioning, and what remediation should be implemented?

  1. A
    SCIM deprovisioning only revokes authentication credentials at the identity provider level but does not modify OAuth authorization scopes assigned to API resource servers; reconfiguring role-based access control policies on the API gateway is required.
  2. B
    SCIM functions strictly as a detective monitoring control to record lifecycle events rather than an automated preventive control capable of modifying user account states across federated identity providers.
  3. The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.Answer
  4. D
    The storage service is located within the enterprise internal network perimeter, which automatically trusts incoming API requests carrying valid authorization headers without verifying token revocation state against the IdP metadata endpoint.

Answer

The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.
The log analysis demonstrates that while SCIM successfully deprovisioned the user object in the Cloud Identity Provider, the user's previously issued long-lived OAuth refresh token remained active. When the API Gateway presented this refresh token, the token endpoint generated a new access token without performing a real-time check against the user's directory account status. To prevent unauthorized post-offboarding access, IAM operations must explicitly revoke active refresh tokens and user sessions upon termination, as well as deploy Continuous Access Evaluation (CAE) to enforce real-time access policy decisions.

Step-by-Step Solution

1
Analyze the account deprovisioning log entries.
Active Directory disabled the user account and SCIM issued an automated DELETE call to the Cloud IdP, which returned HTTP 200 OK.
Confirms that account deprovisioning succeeded at both the primary directory level and the federated identity provider level.
2
Examine the OAuth token refresh event occurring two days post-offboarding.
The API Gateway presented a long-lived refresh token (`rt_88dfa2...`), and the Cloud IdP issued a new short-lived access token (`at_44c12...`) without re-evaluating whether the underlying directory user account was active.
Identifies that standard OAuth 2.0 token endpoints evaluate refresh token validity independently of live directory status unless active session revocation or real-time continuous evaluation is configured.
3
Determine the operational root cause and required security remediation.
The root cause is unrevoked refresh tokens combined with passive token validation. The required control remediation is revoking all active refresh tokens and user session state during offboarding, alongside implementing Continuous Access Evaluation (CAE).
Ensures that identity state changes are immediately propagated and enforced across token endpoints and API resource gateways in real time.

Key Concept

OAuth 2.0 Refresh Token Lifecycle, Session Revocation, and Continuous Access Evaluation (CAE)
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic